Open redirect when login successfully in bookwyrm-social/bookwyrm


Reported on

Jul 11th 2022


Open redirect when login successfully via next parameter

Proof of Concept

POST /login?next= HTTP/2
Cookie: csrftoken=EUjtgvt3A20lSHYbTxBvfAxQi5gNHHzeI7Bda1HOGnWCioMA6cwQqYWXv8ONog4k
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 125
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers


PoC Image



This vulnerability is capable of redirect user to fishing, redirect to attack host,...

We are processing your report and will contact the bookwyrm-social/bookwyrm team within 24 hours. 23 days ago
We have contacted a member of the bookwyrm-social/bookwyrm team and are waiting to hear back 22 days ago
Mouse Reeve validated this vulnerability 20 days ago
Nhien.IT has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Mouse Reeve confirmed that a fix has been merged on a2540e 20 days ago
The fix bounty has been dropped
to join this conversation